Packetbeat uses an internal queue to store events before publishing them. The
queue is responsible for buffering and combining events into batches that can
be consumed by the outputs. The outputs will use bulk operations to send a
batch of events in one transaction.

You can configure the type and behavior of the internal queue by setting options in the queue section of the packetbeat.yml config file.

The memory queue keeps all events in memory. It is the only queue type
supported right now. By default no flush interval is configured. All events
published to this queue will be directly consumed by the outputs.
The output’s bulk_max_size setting limits the number of events being processed at once.

The memory queue waits for the output to acknowledge or drop events. If
the queue is full, no new events can be inserted into the memeory queue. Only
after the signal from the output will the queue free up space for more events to be accepted.

To enforce spooling in the queue, set the flush.min_events and flush.timeout options.

This sample configuration forwards events to the output if 512 events are
available or the oldest available event is already waiting for 5s in the queue:

Minimum number of events required for publishing. If this value is set to 0, the
output can start publishing events without additional waiting times. Otherwise
the output has to wait for more events to become available.